Privacy Notice
Last updated: 19 October 2026
This notice explains how Edoardo Bommarito ("we", "us", "our"), trading as Car Control, collects and uses personal data when you use our website at carcontrol.uk (the "Site"), our free vehicle check preview, and our paid vehicle reports and report pack (together, the "Service"). We are the controller of the personal data described in this notice for the purposes of the UK GDPR and the Data Protection Act 2018, except where this notice says that another organisation, such as Stripe, acts as an independent controller.
1. Who we are
Car Control is operated by Edoardo Bommarito, a private individual, not a company, based at Via Vittorio Emanuele Orlando 39, 90049 Terrasini (PA), Italy.
Our contact email, for data protection requests and general support, is support@carcontrol.uk. See our Contact page for full details.
Because we are based outside the UK, UK GDPR requires us to appoint a UK representative under Article 27 for data protection purposes. We are in the process of evaluating and appointing one; until a representative is named here, please direct any Article 27 enquiry, or any other data protection request, to support@carcontrol.uk.
2. What personal data we collect
We try to collect as little personal data as possible. You do not need to create an account to buy a report or pack, and we do not use advertising or analytics tracking cookies. If you do sign in or create an account, we do not use a password: see the account bullet below. We collect:
- Registration numbers you search. When you look up a vehicle, we log the registration number entered, together with the date and time and your IP address.
- How you found us. If the link you followed or your browser tells us which website or app sent you to the Site (for example a search engine or an AI assistant), we record only the name of that site, not the page or what you searched for. We count it with free previews and keep it with your order if you buy, so we can see which ways of finding us work. We don't use a cookie or store anything on your device for this.
- Server and security logs. Our hosting infrastructure automatically records technical information such as IP address, browser type, pages requested, and timestamps, for security and reliability purposes.
- Order records, if you buy a report or pack. When you buy a Basic report, a Premium report, or the 3 Premium reports pack, we keep a record of the registration you searched, the Stripe checkout session and payment reference, the tier or pack purchased, the amount paid, the date and time of your purchase, the timestamp of your consent to immediate delivery and acknowledgement of the loss of your cancellation right, and the access token for your report link.
- Pack and credit records, if you buy the 3 Premium reports pack, or if we add a free credit. We keep a record of your pack link or code, how many credits remain on your account, which registrations you have redeemed a credit against, the date each credit was redeemed, and the consent given at each redemption. This includes a free Premium credit we add automatically where our commercial data supplier holds no historical records at all for a vehicle, as explained on our Cancellation and Refund Policy. This lets us honour your remaining credits and their 12-month expiry.
- Your email address, if you buy a report or pack. We do not collect your email address ourselves at checkout. Stripe collects it from you as part of the payment process, and passes it to us so that we can send you the confirmation and pack details described in section 5, create an account for that email address as described below, and deal with any refund or cancellation request.
- Account data, if you sign in or an account is created for you. An account is created automatically for the email address used at checkout, and you can also sign in or create an account at any time without a password, using a one-time 6-digit code emailed to you, a one-time sign-in link emailed to you, or "Sign in with Google". If you use Google, we receive only your Google account email address, whether Google has verified it, and a Google account identifier, from Google as described in section 5. We hold your email address, your Google account identifier if you have used Google sign-in, the dates your account was created and last signed into, and your active sign-in sessions. If you delete your account, we remove this record, though we keep the order records described above for the periods set out in section 7.
- Messages you send us. If you email us at support@carcontrol.uk, we keep a record of your message, your email address, and our reply.
We do not ourselves collect or store your card details. We do not ask you to create a password, or provide your name, address or date of birth, to use the Service.
3. Vehicle registration numbers and personal data
A vehicle registration number is not, by itself, always personal data. However, the Information Commissioner's Office (ICO) takes the view that a registration number can become personal data where it can reasonably be linked, directly or indirectly, to an identifiable individual, for example because it is combined with other information such as the vehicle's make, colour and location, or because someone (including us or a third party) is able to connect the registration to its keeper.
Because a registration number you search could be linked to you personally, for example if it is your own vehicle, or could identify another individual, for example a seller's vehicle, we treat the logging of searched registration numbers, including registrations sent to DVSA, DVLA or CheckCarDetails Ltd and registrations redeemed against a pack credit, as processing of personal data and apply this notice to it, even where in a particular case the registration number cannot in fact be linked to an identifiable person.
4. Why we use your personal data and our lawful basis
| What we use it for | Lawful basis |
|---|---|
| Running the Service: sending your registration number to DVSA, DVLA and, where used, CheckCarDetails Ltd, and showing you the results and our analysis | Legitimate interests: operating the free service you have asked to use. We only send the registration number itself to these sources, no other personal data about you. |
| Detecting and preventing abuse, for example automated scraping or excessive querying that could put our data access at risk | Legitimate interests: keeping the Service available, secure and within the terms of our data access |
| Maintaining and improving the Site, understanding usage patterns from logs | Legitimate interests: service improvement and security |
| Responding to your emails and support or data protection requests | Legitimate interests, and where relevant, compliance with our legal obligations, for example under data protection law |
| Taking payment for a report or pack through Stripe, generating and delivering reports, sending confirmation emails, tracking and honouring credits (including a free credit we add automatically where our data supplier has no records for a vehicle), and dealing with any refund or cancellation request | Performance of a contract with you |
| Including, in your order confirmation email and on your report page, a link where you can review Car Control on Trustpilot if you wish. We do not send Trustpilot your email address or any other personal data, and the link comes with no offer or reward. | Legitimate interests: letting customers share honest feedback with other buyers |
| Creating and maintaining your account, letting you sign in by email code, email link or Google, and showing you your credits, open reports and past orders on the "My account" page | Performance of a contract with you, and, for the security of the sign-in itself, legitimate interests in keeping accounts secure |
| Keeping order and credit redemption records, including payment references and consent timestamps, for accounting, tax and dispute purposes | Legal obligation (accounting and tax record keeping), and legitimate interests (being able to show what was agreed and paid for if a dispute or chargeback arises) |
| Preventing and detecting payment fraud, chargebacks and abuse, including misuse of pack credits | Legitimate interests: protecting us and other customers from fraudulent transactions |
| Complying with our legal obligations, for example responding to a lawful request from a regulator or law enforcement body | Legal obligation |
Where we rely on legitimate interests, we have considered whether our interest in providing and protecting the Service is overridden by your interests or fundamental rights and freedoms. Because we collect only a registration number, IP address and timestamp for the free preview, keep it for a short, defined period, do not use it for marketing or profiling, and do not share it other than as described below, we consider our processing to be proportionate and within your reasonable expectations when you choose to use a free vehicle lookup service. You have the right to object to this processing, as explained in section 9 below.
We do not use your personal data for any purpose other than those listed above. We do not sell your personal data, and we do not use it for advertising or profiling.
5. Who we share data with
We send the registration number you enter to DVSA and DVLA, and, where used, to CheckCarDetails Ltd, so that we can retrieve and show you the results, including the valuation and specification data that CheckCarDetails Ltd provides for the Basic and Premium reports, and the additional commercial vehicle history data it provides for the Premium report and pack. We do not send them your IP address, email address or any other personal data. DVSA and DVLA act as independent controllers of the data they hold and provide to us; their own privacy notices apply to how they use that data. CheckCarDetails Ltd processes the registration numbers we send it to look up and return vehicle data to us; whether it acts as our processor or as an independent controller for this purpose depends on the terms of our agreement with it, which we will confirm and update this notice to reflect before launch.
Stripe. If you buy a report or pack, payment is processed on our behalf by Stripe (Stripe Payments Europe, Limited, based in Ireland), through a payment page hosted by Stripe at checkout.stripe.com. You enter your card or other payment details directly with Stripe; we never see or store your full card details. For its role in processing your payment and preventing fraud, Stripe acts as an independent controller of your payment and fraud-prevention data, not as our processor: it decides how it uses the payment data you give it, in line with its own privacy notice. Stripe collects your email address as part of taking payment, and passes your email address, the amount paid, a payment reference, and the last details Stripe shares with us about the transaction back to us, so that we can provide the report, confirmation, pack details and support described in this notice. We never receive your full card number from Stripe. You can read Stripe's privacy notice at stripe.com/privacy.
Google. If you choose to sign in using "Sign in with Google", Google LLC and Google Ireland Limited act as an independent controller of the sign-in data they hold about you, in line with Google's own privacy policy. We receive back from Google only your Google account email address, whether Google has verified it, and a Google account identifier: we do not receive your Google contacts or any other Google data, and Google sign-in is only ever used to let you into your account, not for any other purpose. If you do not use Google sign-in, no data is exchanged with Google.
Email provider. We use Resend to send the confirmation emails described above, including your pack link and credits remaining, your one-time sign-in codes and links, and to send you your access link if you need it resent. Resend processes this on our instructions as a processor.
Cloudflare. We use Cloudflare for DNS and email routing for our domain. Cloudflare processes this on our instructions as a processor.
We host the Site on a server provided by IONOS SE, in the EU (Germany). Our hosting provider processes data on our instructions as a processor and is contractually required to keep it secure.
We do not otherwise share your personal data with third parties, except where required by law, for example in response to a valid court order or a lawful request from a public authority, or where needed to establish, exercise or defend a legal claim, for example in response to a chargeback or payment dispute raised through Stripe or your card issuer.
6. International transfers
We are based in Italy, in the European Economic Area, and we host the Site on a server provided by IONOS SE in the EU (Germany). Data we hold about UK users is therefore itself processed outside the UK, by us. Where our hosting provider, Stripe, CheckCarDetails Ltd, Resend, Cloudflare, Google, or any other processor or independent controller we use stores or accesses data outside the United Kingdom, we will only allow this, or rely on it, where the transfer is protected by UK adequacy regulations (which recognise the EEA, including Italy, Germany and Ireland, as adequate), the UK International Data Transfer Agreement (IDTA), the UK Extension to the EU-US Data Privacy Framework, the UK addendum to the EU standard contractual clauses, or another safeguard recognised under UK data protection law. Stripe Payments Europe, Limited is based in Ireland, within the EEA. Google LLC participates in the UK Extension to the EU-US Data Privacy Framework for transfers of this kind; where that does not apply, transfers rely on the UK addendum to the EU standard contractual clauses. If you would like further detail about a specific transfer, contact support@carcontrol.uk.
7. How long we keep data
- Searched registration numbers, with IP address and timestamp: retained for 30 days, then deleted or anonymised, unless we reasonably need to keep a specific record for longer to investigate suspected abuse or fraud, or to comply with a legal obligation.
- Order records and pack credit redemption records (registration searched, Stripe payment reference, tier or pack purchased, amount paid, date, consent and acknowledgement timestamps, pack link or code, credits remaining, and access token): retained for 6 years from the end of the accounting period in which the purchase or redemption was made, in line with our accounting record keeping obligations and to allow us to deal with disputes, chargebacks and refund or cancellation requests. This applies even if you later delete your account.
- Account data (email address, Google account identifier if used, dates your account was created and last signed into, and active sign-in sessions): retained for as long as your account is open, and deleted when you delete your account from the account page, other than the order records described above, which we keep for 6 years as explained there.
- Report snapshots: deleted after the 30-day access period for that report ends.
- Server and security logs: retained for a limited period necessary for security and reliability purposes, then deleted or anonymised.
- Emails and support correspondence: retained for as long as reasonably necessary to deal with your query and for a reasonable period afterwards in case of follow up, then deleted.
8. Keeping your data secure
Access by our own staff to order and account data is restricted to named administrators, who must use two-factor authentication to sign in, and administrator sign-in and actions are logged. Administrator access uses a separate administrator session cookie, described in our Cookie Policy, and is used only by our staff, not by customers.
9. Your rights
Under the UK GDPR you have the right to:
- be informed about how your personal data is used (this notice);
- request access to the personal data we hold about you;
- request that we correct inaccurate personal data;
- request that we erase your personal data, in certain circumstances;
- request that we restrict the processing of your personal data, in certain circumstances;
- object to our processing of your personal data where we rely on legitimate interests, including the logging described in this notice;
- request portability of personal data you have provided to us, in certain circumstances; and
- not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. We do not carry out this kind of automated decision making.
To exercise any of these rights, email support@carcontrol.uk. If you have an account, you can delete it yourself at any time from the account page, which removes your account record and signs you out everywhere, though we keep order records for 6 years as explained in section 7. For anything else, or if you do not have an account, please tell us the registration number, or your pack link or code, and the approximate date and time you searched or purchased, so we can locate the relevant record. We will respond within one month, as required by law, and may extend this by up to two further months for complex requests, in which case we will tell you why.
You also have the right to complain to the Information Commissioner's Office (ICO) if you think we have not handled your personal data properly. You can contact the ICO at ico.org.uk, or by telephone on 0303 123 1113. We would appreciate the chance to address your concern before you contact the ICO, so please contact us first at support@carcontrol.uk if you are able to.
10. Children
The Service is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact support@carcontrol.uk and we will take appropriate steps to remove it.
11. Cookies and similar technologies
Details of the cookies and similar storage used on the Site, including the report and pack access tokens stored in local storage, the sign-in session cookie, the short-lived Google sign-in cookie, the administrator session cookie, and why no cookie consent banner is currently needed, are set out in our Cookie Policy.
12. Changes to this notice
We may update this notice from time to time, for example if we change how the Service works or if the law changes. We will update the "last updated" date at the top of this page when we do.